{"id":"CVE-2018-1000528","aliases":["DEBIAN-CVE-2018-1000528","DLA-1436-1","DSA-4239-1","EUVD-2018-1921","GHSA-fh4v-6j27-m5mf","UBUNTU-CVE-2018-1000528","USN-4609-1"],"status":"published","title":"GONICUS GOsa version before commit 56070d6289d47ba3f5918885954dcceb75606001 contains a Cross Site...","description":"GONICUS GOsa version before commit 56070d6289d47ba3f5918885954dcceb75606001 contains a Cross Site Scripting (XSS) vulnerability in change password form (html/password.php, #308) that can result in injection of arbitrary web script or HTML. This attack appear to be exploitable via the victim must open a specially crafted web page. This vulnerability appears to have been fixed in after commit 56070d6289d47ba3f5918885954dcceb75606001.","severity":{"version":"3.0","score":6.1,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","level":"medium","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-09","score":0.46118,"percentile":0.98819,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-79"],"published":"2018-06-26T16:00:00Z","modified":"2026-10-24T10:49:32Z","fixes":[{"ecosystem":"Debian:12","package":"gosa","fixed_in":["2.7.4+reloaded3-5"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"gosa","fixed_in":["2.7.4+reloaded3-5"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"gosa","fixed_in":["2.7.4+reloaded3-5"],"sources":["osv"]},{"ecosystem":"Debian:8","package":"gosa","fixed_in":["2.7.4+reloaded2-1+deb8u3"],"sources":["osv"]},{"ecosystem":"Debian:9","package":"gosa","fixed_in":["2.7.4+reloaded2-13+deb9u1"],"sources":["osv"]},{"ecosystem":"Ubuntu:16.04:LTS","package":"gosa","fixed_in":["2.7.4+reloaded2-9ubuntu1.1"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Debian:12","package":"gosa","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.7.4+reloaded3-5"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"gosa","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.7.4+reloaded3-5"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"gosa","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.7.4+reloaded3-5"}]}]},{"source":"osv","ecosystem":"Debian:8","package":"gosa","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.7.4+reloaded2-1+deb8u3"}]}],"versions":["2.7.4+reloaded2-1","2.7.4+reloaded2-1+deb8u1","2.7.4+reloaded2-1+deb8u2"]},{"source":"osv","ecosystem":"Debian:9","package":"gosa","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.7.4+reloaded2-13+deb9u1"}]}],"versions":["2.7.4+reloaded2-13"]},{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"gosa","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.7.4+reloaded2-9ubuntu1.1"}]}],"versions":["2.7.4+reloaded2-2","2.7.4+reloaded2-5","2.7.4+reloaded2-6","2.7.4+reloaded2-7","2.7.4+reloaded2-8","2.7.4+reloaded2-9","2.7.4+reloaded2-9ubuntu1"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"gosa","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.7.4+reloaded2-13ubuntu1","2.7.4+reloaded3-2ubuntu1","2.7.4+reloaded3-3"]},{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"gosa","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.7.4+reloaded2-9ubuntu1.1"}]}],"versions":["2.7.4+reloaded2-2","2.7.4+reloaded2-5","2.7.4+reloaded2-6","2.7.4+reloaded2-7","2.7.4+reloaded2-8","2.7.4+reloaded2-9","2.7.4+reloaded2-9ubuntu1"],"bundled":3}],"products":[{"vendor":"debian","product":"debian_linux"},{"vendor":"gonicus","product":"gosa"}],"references":[{"url":"https://www.debian.org/security/2018/dsa-4239","tags":["vendor-advisory","x_refsource_DEBIAN","x_transferred","Third Party Advisory","advisory"]},{"url":"https://lists.debian.org/debian-lts-announce/2018/07/msg00028.html","tags":["mailing-list","x_refsource_MLIST","x_transferred","Mailing List","Third Party Advisory","advisory"]},{"url":"https://github.com/gosa-project/gosa-core/issues/14","tags":["x_refsource_MISC","x_transferred","Third Party Advisory","advisory","report"]},{"url":"https://github.com/gosa-project/gosa-core/commit/56070d6289d47ba3f5918885954dcceb75606001","tags":["x_refsource_MISC","x_transferred","Patch","Third Party Advisory","fix","report"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2018-1000528"},{"url":"https://github.com/advisories/GHSA-fh4v-6j27-m5mf"},{"url":"https://security-tracker.debian.org/tracker/CVE-2018-1000528","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2018-1000528","tags":["report"]},{"url":"https://ubuntu.com/security/notices/USN-4609-1","tags":["advisory"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2018-1000528","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2019-11187","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2019-14466","tags":["report"]}],"sources":{"cve":[{"id":"CVE-2018-1000528","description":"GONICUS GOsa version before commit 56070d6289d47ba3f5918885954dcceb75606001 contains a Cross Site Scripting (XSS) vulnerability in change password form (html/password.php, #308) that can result in injection of arbitrary web script or HTML. This attack appear to be exploitable via the victim must open a specially crafted web page. This vulnerability appears to have been fixed in after commit 56070d6289d47ba3f5918885954dcceb75606001.","status":"published","published":"2018-06-26T16:00:00Z","modified":"2024-08-05T12:40:47.253Z","updated_at":"2026-11-02T14:35:10.685174Z"}],"euvd":[{"id":"EUVD-2018-1921","description":"GONICUS GOsa version before commit 56070d6289d47ba3f5918885954dcceb75606001 contains a Cross Site Scripting (XSS) vulnerability in change password form (html/password.php, #308) that can result in injection of arbitrary web script or HTML. This attack appear to be exploitable via the victim must open a specially crafted web page. This vulnerability appears to have been fixed in after commit 56070d6289d47ba3f5918885954dcceb75606001.","status":"published","published":"2018-06-26T16:00:00Z","modified":"2024-08-05T12:40:47Z","updated_at":"2026-11-03T02:39:26.268404Z"}],"ghsa":[{"id":"GHSA-fh4v-6j27-m5mf","title":"GONICUS GOsa version before commit 56070d6289d47ba3f5918885954dcceb75606001 contains a Cross Site...","description":"GONICUS GOsa version before commit 56070d6289d47ba3f5918885954dcceb75606001 contains a Cross Site Scripting (XSS) vulnerability in change password form (html/password.php, #308) that can result in injection of arbitrary web script or HTML. This attack appear to be exploitable via the victim must open a specially crafted web page. This vulnerability appears to have been fixed in after commit 56070d6289d47ba3f5918885954dcceb75606001.","status":"published","published":"2022-05-14T03:02:50Z","modified":"2023-02-02T05:07:08Z","cvss":[{"version":"3.0","score":6.1,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","level":"medium"}],"cwes":["CWE-79"],"updated_at":"2026-11-02T14:52:26.447554Z"}],"nvd":[{"id":"CVE-2018-1000528","description":"GONICUS GOsa version before commit 56070d6289d47ba3f5918885954dcceb75606001 contains a Cross Site Scripting (XSS) vulnerability in change password form (html/password.php, #308) that can result in injection of arbitrary web script or HTML. This attack appear to be exploitable via the victim must open a specially crafted web page. This vulnerability appears to have been fixed in after commit 56070d6289d47ba3f5918885954dcceb75606001.","status":"published","published":"2018-06-26T16:29:01.697Z","modified":"2026-06-17T01:32:50.883Z","cvss":[{"version":"3.0","score":6.1,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","level":"medium","assessor":"primary"},{"version":"2.0","score":4.3,"vector":"AV:N/AC:M/Au:N/C:N/I:P/A:N","level":"medium","assessor":"primary"}],"cwes":["CWE-79"],"updated_at":"2026-11-02T14:04:30.900603Z"}],"osv":[{"id":"CVE-2018-1000528","description":"GONICUS GOsa version before commit 56070d6289d47ba3f5918885954dcceb75606001 contains a Cross Site Scripting (XSS) vulnerability in change password form (html/password.php, #308) that can result in injection of arbitrary web script or HTML. This attack appear to be exploitable via the victim must open a specially crafted web page. This vulnerability appears to have been fixed in after commit 56070d6289d47ba3f5918885954dcceb75606001.","status":"published","published":"2018-06-26T16:29:01.697Z","modified":"2026-10-24T10:49:32.430624538Z","cvss":[{"version":"3.0","score":6.1,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","level":"medium"}],"updated_at":"2026-11-02T15:44:07.192756Z"},{"id":"DEBIAN-CVE-2018-1000528","description":"GONICUS GOsa version before commit 56070d6289d47ba3f5918885954dcceb75606001 contains a Cross Site Scripting (XSS) vulnerability in change password form (html/password.php, #308) that can result in injection of arbitrary web script or HTML. This attack appear to be exploitable via the victim must open a specially crafted web page. This vulnerability appears to have been fixed in after commit 56070d6289d47ba3f5918885954dcceb75606001.","status":"published","published":"2018-06-26T16:29:01.697Z","modified":"2026-10-23T18:03:17.884058871Z","cvss":[{"version":"3.0","score":6.1,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","level":"medium"}],"updated_at":"2026-11-02T15:45:29.988046Z"},{"id":"UBUNTU-CVE-2018-1000528","description":"GONICUS GOsa version before commit 56070d6289d47ba3f5918885954dcceb75606001 contains a Cross Site Scripting (XSS) vulnerability in change password form (html/password.php, #308) that can result in injection of arbitrary web script or HTML. This attack appear to be exploitable via the victim must open a specially crafted web page. This vulnerability appears to have been fixed in after commit 56070d6289d47ba3f5918885954dcceb75606001.","status":"published","published":"2018-06-26T16:29:00Z","modified":"2026-04-22T11:39:27.274952Z","cvss":[{"version":"3.0","score":6.1,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","level":"medium"}],"updated_at":"2026-11-02T15:54:16.544091Z"},{"id":"DLA-1436-1","title":"gosa - security update","status":"published","published":"2018-07-21T00:00:00Z","modified":"2026-03-09T01:01:24.036972Z","updated_at":"2026-11-02T15:46:09.336894Z"},{"id":"DSA-4239-1","title":"gosa - security update","status":"published","published":"2018-07-03T00:00:00Z","modified":"2026-03-09T02:09:54.741611Z","updated_at":"2026-11-02T15:46:16.862196Z"},{"id":"USN-4609-1","title":"gosa vulnerabilities","description":"Fabian Henneke discovered that GOsa incorrectly handled client cookies. An\nauthenticated user could exploit this with a crafted cookie to perform\nfile deletions in the context of the user account that runs the web\nserver. (CVE-2019-14466)\n\nIt was discovered that GOsa incorrectly handled user access control. A\nremote attacker could use this issue to log into any account with a\nusername containing the word \"success\". (CVE-2019-11187)\n\nFabian Henneke discovered that GOsa was vulnerable to cross-site scripting\nattacks via the change password form. A remote attacker could use this\nflaw to run arbitrary web scripts. (CVE-2018-1000528)\n","status":"published","published":"2020-10-28T19:46:46Z","modified":"2026-04-27T15:46:23.451493Z","updated_at":"2026-11-02T16:58:15.159055Z"}]}}